# Make responsibility visible when the record changes. Define ownership, access and change responsibilities for industrial information, equipment mappings, operating definitions and cross-team reviews. Canonical: https://vieox.com/insights/ot-governance/ownership-access-and-change/ Publisher: VIEOX Published: 2026-10-20 Updated: 2026-10-20 ## How should an OT information initiative handle ownership, access and change? Identify the responsible owners of sources and definitions, give users access for their approved work and keep a reviewable account of consequential changes. Record why a correction was made, where it applies and whether it affects earlier interpretations. Make the route for reporting a problem clear to ordinary users. An information practice becomes dependable when people know how to resolve a mismatch, request appropriate access and understand a change. These everyday moments deserve as much attention as the first dashboard because they shape what later readers can reasonably trust. ## Name the person who can resolve the question An owner should be reachable through a practical route. A maintenance colleague may confirm an equipment identity, a production specialist may explain a cycle boundary and quality may determine the meaning of an inspection outcome. Avoid assigning every question to a generic technical mailbox. Keep the distinction between maintaining a record and deciding its operating consequence. The person correcting a timestamp may not be the person authorised to reassess a product disposition. A good handoff brings the correction to the right reviewer. ## Plan how access begins, changes and ends Describe the work a role needs to perform and which operating scope it covers. Consider temporary project participation and partner involvement as well as permanent staff. Agree who approves access and who reviews it when responsibilities or relationships change. Present access boundaries plainly. A reader should be able to understand that a detail is outside their scope and know how to request the appropriate review. Avoid encouraging users to pass screenshots or exported records around simply because the legitimate route is unclear. ## Treat consequential changes as part of the operating record NIST’s guidance on security-focused configuration management treats information security as part of an organisation’s wider configuration-management practice. For an OT information initiative, the useful connection is to consider the implications of changes within the existing responsibilities for managing the system and its operating environment. Sources: [1](https://csrc.nist.gov/pubs/sp/800/128/upd1/final) ## A correction needs a scope and a reason Record the previous definition, the corrected one and the evidence supporting the change. Explain whether it applies to new records, a historical period or a specific operating area. If a correction changes a comparison, make that consequence visible to its users. Hypothetical example: two pumps were assigned the same informal label in separate records. The correction distinguishes the assets and identifies the reports that used the ambiguous label. Reviewers can then reconsider affected findings with the right equipment context. ## A reviewable result is not permission to act An investigation can reach a technical conclusion while still requiring a separate decision about work, access or operational change. Preserve the responsible assessment and the authorisation route. This is especially important when an external specialist or an AI tool contributes to the interpretation. Make emergency and exception handling part of the site’s established arrangements. The information initiative should support a clear record of what happened without inventing a shortcut around the people responsible for the operation. ## Test the practice with a correction, a departure and a handover Walk through three ordinary situations: a user reports a misleading definition, a partner’s involvement ends and a new team takes over a review. Ask whether ownership, access and supporting history remain clear in each case. The answers reveal more than a list of policy headings. Record any friction and agree a focused improvement. The intended result is a maintainable way of working that keeps information useful as people, equipment and projects change. ## Practical starting points - Name owners for important sources and definitions. - Define access around the task and operating scope. - Preserve the reason and boundary of corrections. - Identify earlier decisions that a change may affect. - Check handover and partner-access closure in practice. ## Questions, answered ### Can an operator report an incorrect definition? A useful practice should give the people using the information a clear way to report a mismatch. The appropriate owner can then verify and approve the correction while preserving its history. ### Should a corrected result erase the earlier version? Keep enough history to explain what earlier users saw and why the result changed, subject to the applicable retention and information-handling rules. Silent replacement makes later review harder. ## Sources and further reading - [NIST SP 800-128 — Guide for Security-Focused Configuration Management of Information Systems](https://csrc.nist.gov/pubs/sp/800/128/upd1/final) ## Related reading - [OT governance: explore the series](https://vieox.com/insights/ot-governance/) - [Governing industrial ai](https://vieox.com/insights/ot-governance/governing-industrial-ai/) - [Governed access for people and AI](https://vieox.com/insights/data-democratization/access-for-people-and-ai/) - [Say hello to VIEOX](https://vieox.com/contact/)